Alarm mentions, targeted --set, and a logout that actually logs out

Mentions
- bin/vgnotify.sh is shared by the alert timer and the deadman. A webhook will not ping a role
  from <@&id> in the content alone: the request has to whitelist it, so every post now sends an
  explicit allowed_mentions. parse is always [] as well, so an @everyone appearing inside a log
  line or filename in an alert text can never ping the server.
- ALERT_MENTION is written as role:<id>/user:<id> rather than raw Discord syntax, and
  ALERT_MENTION_LEVELS keeps pings to errors by default so warnings arrive quietly. The deadman
  pings too, because its alarm means nothing else can get through, but its recovery is info level.
- Both scripts now read /etc/vanguard/alerts.env themselves instead of relying on systemd to
  inject it. Running one by hand previously behaved differently from the timer, which is exactly
  how "the mention is configured but never appears" happened.

configure.py --set
- Change one setting and apply only what it needs. --full re-prompts for every hostname and
  secret, which is far too blunt for pointing the alarms at a new channel, and mistyping a
  hostname there has broken TLS before.
- Every Discord credential and webhook is now one commented block at the top of .env, so there is
  one place to look, and --show prints the same five together with the secrets truncated.
- Each key applies only its own side effect: the webhook rewrites its root-only file, the deploy
  webhook rewrites deploy.env, the bot token recreates the bot container, log retention re-injects
  the ILM delete phase. LIVE_WEBHOOK_URL deliberately stops short, because MediaMTX only reads it
  at start and a recreate cuts a live recording.

Logout
- The proxy provider pointed at default-provider-invalidation-flow ("Logged out of application"),
  which ends only that application's session and leaves the SSO session alive, so /logout dropped
  the proxy cookie and forward-auth signed the user straight back in. It looked like a refresh.
  default-invalidation-flow ("Logout") is what Authentik's own button uses. --apply now enforces

  it had explicitly recommended the wrong flow.

Sweep
- The band-removal branch overwrote $reasocodec> marker, which is the
  only signal telling the encode to convert audio. A Go Live stream with both the band and Opus
  audio therefore got -c:a copy and shippeachable once Windows Go
  Live audio started working.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/vgnotify.sh

@@ -0,0 +1,74 @@
+# Shared Discord delivery for bin/vanguard-alerts.sh and bin/vanguard-deadman.sh. Sourced, never executed.
+#
+#   . /usr/local/bin/vgnotify.sh
+#   vg_post error "disk is nearly full"     # 0 = delivered, 1 = not (no webhook, bad URL, or HTTP failure)
+#
+# WHY MENTIONS NEED allowed_mentions
+# Putting <@&ROLE_ID> in a webhook's content is not enough on its own: Discord will render it but will not
+# reliably ping, because a webhook has no permission to mention roles unless the request says which mentions
+# are allowed. So every post sends an explicit allowed_mentions. It also sets parse: [] always, which means
+# an @everyone appearing inside an alert's text (a log line, a filename) can never ping the whole server.
+#
+# ALERT_MENTION is written for humans rather than for Discord's syntax:
+#   ALERT_MENTION='role:1387247501387628585,role:1566623319027880086'   -> pings those roles
+#   ALERT_MENTION='user:123456789'                                 -> pings that person
+# Raw '<@&123>' / '<@123>' is accepted too and passed through unchanged.
+#
+# ALERT_MENTION_LEVELS decides which alarms are worth a ping; the default is errors only, so warnings still
+# arrive in the channel without waking anyone.
+
+VG_WEBHOOK_FILE="${ALERT_WEBHOOK_FILE:-/etc/vanguard/alert-webhook}"
+VG_MENTION="${ALERT_MENTION:-}"
+VG_MENTION_LEVELS="${ALERT_MENTION_LEVELS:-error}"
+
+# The webhook URL, or nothing. A value that is not https is treated as absent and complained about once:
+# posting to it would fail anyway, and silently "succeeding" would be worse.
+vg_webhook() {
+  local url
+  [[ -r $VG_WEBHOOK_FILE ]] || return 1
+  url=$(tr -d '[:space:]' < "$VG_WEBHOOK_FILE" 2>/dev/null) || return 1
+  case "$url" in
+    https://*) printf '%s' "$url" ;;
+    "")        return 1 ;;
+    *)         echo "vgnotify: the configured webhook is not an https URL; ignoring it" >&2; return 1 ;;
+  esac
+}
+
+vg_post() {
+  local level="$1" text="$2" url payload code
+  url=$(vg_webhook) || return 1
+  payload=$(VG_LEVEL="$level" VG_TEXT="$text" VG_MENTION="$VG_MENTION" VG_LEVELS="$VG_MENTION_LEVELS" python3 - <<'PY'
+import json, os, re
+level   = os.environ.get("VG_LEVEL", "")
+text    = os.environ.get("VG_TEXT", "")
+raw     = os.environ.get("VG_MENTION", "").strip()
+levels  = [l.strip() for l in os.environ.get("VG_LEVELS", "error").split(",") if l.strip()]
+
+users, roles, parts = [], [], []
+for entry in [e.strip() for e in raw.replace(" ", ",").split(",") if e.strip()]:
+    if entry.startswith("role:"):
+        roles.append(entry[5:]); parts.append(f"<@&{entry[5:]}>")
+    elif entry.startswith("user:"):
+        users.append(entry[5:]); parts.append(f"<@{entry[5:]}>")
+    else:                                   # already Discord syntax
+        parts.append(entry)
+        roles += re.findall(r"<@&(\d+)>", entry)
+        users += re.findall(r"<@!?(\d+)>", entry)
+
+ping = bool(parts) and level in levels
+prefix = (" ".join(parts) + " ") if ping else ""
+# parse: [] unconditionally — an @everyone inside alert text must never ping the server.
+body = {"content": (prefix + text)[:1900],
+        "allowed_mentions": {"parse": [],
+                             "users": sorted(set(users)) if ping else [],
+                             "roles": sorted(set(roles)) if ping else []}}
+print(json.dumps(body))
+PY
+)
+  code=$(curl -s -o /dev/null -w '%{http_code}' -m 15 -X POST \
+           -H 'Content-Type: application/json' -d "$payload" "$url" || true)
+  case "${code:-000}" in
+    2*) return 0 ;;
+    *)  echo "vgnotify: webhook post failed, HTTP ${code:-000}" >&2; return 1 ;;
+  esac
+}